Hi everyone, I'm David, the solo developer and owner of BlindLock. This is my second post here.

BlindLock is more than a year of work. Not a weekend hobby project I threw together. I've put a hell of a lot of time, heart, and nerves into it.

Why steganography?

Picture a burglar. He looks for valuables, the obvious ones: gold, cash, jewelry, the safe in the basement. The picture of your kid on the fridge, the holiday photo on the wall, are irrelevant to him. That's exactly the principle BlindLock is built on. Hackers go after cookies, passwords in the browser, container files that can be decrypted with a password on any computer, crypto seeds, and other sensitive data. Anyone who can log into your Google account or your ChatGPT knows more about you than they could learn in a personal conversation with you. All of that can be grabbed with RATs and other malware, passwords included. BlindLock hides exactly these sensitive logins and passwords inside a picture, because a photo has almost no value to an attacker. And he'd first have to identify the picture as his target at all. On top of that, BlindLock seals this picture to the security chip of your computer. That means: even if an attacker copies the picture, together with the password, he cannot get at your data. The same chip sealing applies to the container vault files. And for these larger files BlindLock has a built-in file explorer, so you can open and edit files without mounting them into the OS. Wherever the respective OS allows it, I've written it to leave no traces behind.

Why isn't BlindLock open source?

That was the most frequent question. Take Bitwarden as an example. Bitwarden sells a service: servers, sync, accounts. The code can be open because the value isn't in the code. I sell the program itself. There's no service behind it, no cloud, nothing on my side that the customer would need. The entire value is in the program itself. That's why Bitwarden can give the code away and make it public for everyone, and I can't.

What's open on my side is what has to be open: the cryptography libraries are freely available and partly formally verified (HACL, level 5, the highest). Anyone can audit them, down to the smallest detail.

The network: BlindLock is offline at its core

The main software never has an internet connection. Nothing goes out. That's not a setting, it's the build, the architecture: BlindLock is built so it can't reach the internet at all. There is no HTTP client in the program. There is no code, no module, no function that could open a connection to the outside.

Everything that needs the server runs in a separate small program, the Net-Helper. It ships in the same package and installs with BlindLock, but runs as its own process with its own binary. BlindLock starts it, asks it a question, and gets an answer. No port, no socket, just the child process's standard input and output. The helper never sees a vault or a password. It has exactly two jobs: it checks the license, and it checks whether the latest BlindLock version is installed. If there's a new version, it downloads the update package and hands it over.

In short: when you open BlindLock, it pings the server through the helper. That's it. There is no other internet connection. You can also use BlindLock offline for 7 days at any time.

Tech stack, licenses, and WalletLink in my first comment below. Happy to answer everything here personally. Anyone can try BlindLock free for 7 days. No email, no payment details.

David

"Project Dream" SNES Prototype Uploaded to Internet Archive

Using Tags

Show HN: BlindLock – Passwords hidden in a photo, sealed to your TPM/SE

Show HN: I graded 200 AI tools/apps and track any changes in their policies

Release 13.2.1 · Grafana/Grafana

Show HN: KeepUp – Verified net worth rankings for everyone

The Beatles: Detecting cultural wordplay in scientific literature using LLMs

Bending Spoons Agrees to Buy Miro for $1.36B

6th Mind Version 2

Show HN: Relay – a voice layer for dense dashboards (MIT)

Begging everyone in his network to help is son find a job – any job

Canadian Students Say AI Is Hurting Their Critical Thinking

Show HN: Apparat/UI – React UI library for vibecoded creative tools

Julia 1.13 Highlights

Continuous field vector DB in Rust to block RAG hallucinations

OECD education report: sustained math and reading decline since 2012

DeepSeek-v4.1-Flash: smarter, faster, more efficient

Where Starting over Doesn't Mean Starting Fresh

An offline payment protocol PUF+ECC that works with Zero Connectivity

Geekbench 6: Apple A20 Pro vs. A19 Pro

Chrome is displaying a clean, Safe-Browsing-cleared extension as malware

If you don't care, then why should I

Echoes of Stuxnet: How a 16-Year-Old Hacking Trick Is Finding New Life

List of references on Sony websites to players "owning" their digital games

Anthropic Researcher Publicly Quits: Labs Are "Gambling with Our Lives"

Show HN: A free API to query 3.5B subdomains

Retune FM – Your receiver's radio, back on air

Urban congestion relief experiments through routing-app interventions

What If We're "Solving" Alignment?

Will AI soon lead to double-digit growth?

Ask HN: Why does Google allow extensions using ExtPay and similar